RE: learning sniffer skills

["Matt Arntsen" <Matt.Arntsen () FranklinCovey com>]

In addition, you can try this:

tcpdump -i "interface name" -s 1518 -lenvv host "whatever host" and port 110 -w /tmp/"file name"



-----Original Message-----
From: Matias Rollan [mailto:matias () safesource com ar] 
Sent: Thursday, December 09, 2004 3:32 PM
To: security-basics () securityfocus com
Subject: Re: learning sniffer skills

Hola !

> Im trying read with tcpdump or snort the mail messages downloaded by
> pop3.  But can see the message content.    How can "assembly" the
> message readed with the sniffer?

        I think you are trying to do something like this:

        tcpdump -s 2000 port 110 -w /tmp/data-to-port-110

        And to see the binary log:

        strings /tmp/data-to-port-110

        Saludos !

-- 
  Matías Rollán
  <cygar () safesource com ar>